CVE-2017-15110: Moodle Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2017-15110: Moodle Exposure of Sensitive Information to an Unauthorized Actor. Affects moodle/moodle across 3 version ranges.
>= 3.1, < 3.1.9
>= 3.2, < 3.2.6
>= 3.3, < 3.3.3
Fixed in 3.1.9, 3.2.6 or 3.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing students and teachers to interact and collaborate. Moodle offers various features such as course management, content creation, assessment tools, and communication channels. However, a vulnerability in Moodle 3.x allows unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Moodle 3.x allows students to discover the email addresses of other students in the same course. By using the search function on the Participants page, students can search for email addresses of all participants, regardless of email visibility settings. This enables the enumeration and guessing of email addresses of other students, potentially leading to privacy breaches and unauthorized access to personal information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.93.1.9composer require moodle/moodle:3.1.9 -
>= 3.2, < 3.2.63.2.6composer require moodle/moodle:3.2.6 -
>= 3.3, < 3.3.33.3.3composer require moodle/moodle:3.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to apply the available patches or upgrade to the recommended versions to mitigate the risk.
Conclusion
The vulnerability in Moodle 3.x exposes sensitive information, specifically email addresses of students, to unauthorized actors. To mitigate this risk, users should upgrade their Moodle installations to the recommended versions or apply the available patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online course management and collaboration.
The vulnerability allows unauthorized access to email addresses of students, potentially leading to privacy breaches and unauthorized access to personal information.
Moodle versions 3.1, 3.2, and 3.3 are affected by this vulnerability.
To fix this vulnerability, upgrade your Moodle installation to version 3.1.9, 3.2.6, or 3.3.3 or later.
There is no specific workaround provided. It is recommended to apply the available patches or upgrade to the recommended versions.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
